Application window is expected to close by 04/30/2025.

Job posting may be removed earlier if the position is filled or if enough applications are received.

Existing or previous Government Security Clearance is required with ability to obtain TS/SCI.

Work must be completed onsite in a secure space at our RTP office. No Hybrid or Remote.

Meet the Team 

Cisco's Security Visibility and Incident Command (SVIC) forms part of the investigative branch of Cisco's Security and Trust Organization (S&TO) and is Cisco's cyber investigations and forensics team. It provides Cisco with tailored security monitoring services in order to protect Cisco from cyber-attacks and the loss of its intellectual assets. The primary mission of SVIC is to help ensure company, system, and data preservation by performing comprehensive investigations into computer security incidents, and to give to the prevention of such incidents by engaging in dedicated threat assessment, mitigation planning, incident trend analysis, and security architecture review. 

The SVIC is a highly-functioning, diverse, and globally distributed group of best-in-class professionals from various technical backgrounds. We're Open-Source Software contributors, technical authors, tool builders, DFIR community members, lock pickers, makers, and breakers.

Your Impact

SVIC is looking for an experienced security professional to join the Computer Security Incident Response Team. This is an opportunity to contribute to a highly transparent security operations function with global impact upon Cisco, its diversified business, business units, service ventures, partners, and customers. We are looking for a motivated individual with good team fit and the ability to focus on data security and incident analysis. You have a very strong interest in complex problem solving, ability to challenge assumptions, consider alternative perspectives, nimble thinking and perform in high-stress situations, while operating exceedingly well in a strong, tight-knit, collaborative team environment.

Responsibilities Include

Document cases, procedures, analysis, and investigations accurately and thoroughly (including best-practice documentation).Assist with setup and tuning of multiple security monitoring products and data feedsCollaborate with data source SMEs in SVIC and InfoSec to enhance, improve, or modify cloud (IaaS, SaaS, etc) based security detection and response.Update, modify, and enhance existing programs used for security detection and response.Develop documentation on all custom solutions.Identify attackers and their methods but also use your IT and networking expertise to improve detection logic.Occasional travel (<10%)

Attack Analysis

Attacker Tools, TTPsLog Analysis (System, Firewall, Application

Cyber Threat Intelligence

Threat HuntingIntelligence AnalysisAttacker MethodologyIndustry Peer Collaboration & Information Sharing

Incident/Investigations Handling

CyberSecurity Impact AssessmentCyberSecurity Problem ManagementAutomation/SOARRoot Cause ID / LTF

Minimum Qualifications

4 + years of Cybersecurity or IT security related work experience.Python scripting/coding experience Experience with any three or more of the following tools: Splunk, CSE(AMP4E), Network AMP, WSA, Firepower IPS, NGFW, ESA, CTA, Threat-Grid, Stealthwatch, Umbrella, SecureX, OSQuery, Threat-Quotient, MISP, Recorded-Future, Volatility, Powershell, Wireshark, Encase, Tableau, TheHiveMust have Experience with Log Analysis (System, Firewall, Application)

Preferred Qualifications

Good technical skills in a variety of operating system, languages, and databasesExperience with - Go, Java, JavaScript, SQL, MySQL, STIX/TAXII AND/OR MITRE ATT&CKCertifications GSEC, GCIA, GISF, GCED, GCFA, GCFE, GREM, GCTI, GASF, GCEH, CISSP, CCSP OR SSCPCloud experience with AWS or Azure.Agility and willingness to deal with a high level of ambiguity and changeFlexibility – willingness to pitch in where needed across program and team

# WeAreCisco

#WeAreCisco where every individual brings their unique skills and perspectives together to pursue our purpose of powering an inclusive future for all. 

Our passion is connection—we celebrate our employees’ diverse set of backgrounds and focus on unlocking potential. Cisconians often experience one company, many careers where learning and development are encouraged and supported at every stage. Our technology, tools, and culture pioneered hybrid work trends, allowing all to not only give their best, but be their best. 

We understand our outstanding opportunity to bring communities together and at the heart of that is our people. One-third of Cisconians collaborate in our 30 employee resource organizations, called Inclusive Communities, to connect, foster belonging, learn to be informed allies, and make a difference. Dedicated paid time off to volunteer—80 hours each year—allows us to give back to causes we are passionate about, and nearly 86% do! 

Our purpose, driven by our people, is what makes us the worldwide leader in technology that powers the internet. Helping our customers reimagine their applications, secure their enterprise, transform their infrastructure, and meet their sustainability goals is what we do best. We ensure that every step we take is a step towards a more inclusive future for all. Take your next step and be you, with us!